Playwright test for Run trust loop on /demo

## Summary

Browser tests only assert the trust-loop **button is visible**. API coverage lives in `tests/integration/test_demo.py`. The public demo story is cite FAQ → replay → inbox; that UI path is untested.

## Context

- `tests/browser/test_critical_paths.py` (`test_demo_mic_control_visible`)
- `public/demo/index.html` / `public/demo/app.js`
- Distinct from #31 (barge-in) and #20 (375px smoke)

## Acceptance criteria

- [ ] Click **Run trust loop** with `DEMO_ENABLED=true`
- [ ] Assert citations, inspect/replay links, and a success status in `#out-status`
- [ ] Stable in CI with mock providers

Start with tests/browser/test_critical_paths.py, especially test_demo_mic_control_visible, and review public/demo/index.html and public/demo/app.js to trace the trust-loop UI. Run the existing browser-test setup with mock providers, then verify the test covers the enabled demo flow. Done means CI-stable assertions for citations, inspect/replay links, and success in #out-status.

Written by the indexing model from the issue text.